topic Re: PA Active/Passive and Cisco stacking LACP in General Topics

PA Active/Passive and Cisco stacking LACP

K.Mohamed — Mon, 12 Aug 2024 08:21:51 GMT

hello,

we have setup Active/ Passive connected with cisco stacking 9500 with four links full-mesh as shown below:

Paloalto active:

PA(active) AE1 ========= cisco-1 switch (Etherchanel 10)

PA(active) AE1 ========= cisco-2 switch (Etherchanel 20)

Paloalto Passive:

PA(passive) AE1 ========= cisco-1 switch (Etherchanel 10)

PA(passive) AE1 ========= cisco-2 switch (Etherchanel 20)

=================================================

Is the connection and configuration is correct or i should create 2 channels from Paloalto side like this example?

Re: PA Active/Passive and Cisco stacking LACP

PavelK — Tue, 13 Aug 2024 06:39:11 GMT

Hello @K.Mohamed

to me this configuration does not look ideal.

You are having 2 ports on PA side in a single port channel group and on Cisco side each port is in different port channel group. With this configuration you might have an issue with Cisco's EtherChannel guard kicking in to take ports into error disabled state.

Personally I would configure port channel 10 to Active Firewall and port channel 20 to Passive Firewall.

Paloalto active:

PA(active) AE1 ========= cisco-1 switch (Etherchanel 10)

PA(active) AE1 ========= cisco-2 switch (Etherchanel 10)

Paloalto Passive:

PA(passive) AE1 ========= cisco-1 switch (Etherchanel 20)

PA(passive) AE1 ========= cisco-2 switch (Etherchanel 20)

Also, passive Firewall will have data plane interfaces down, so there will not be any passing traffic of this port channel until there is failover event.

Kind Regards

Pavel

Re: PA Active/Passive and Cisco stacking LACP

K.Mohamed — Tue, 13 Aug 2024 12:32:07 GMT

Great,

For LACP should be active or Passive ?on cisco and PA,,,

Thank you,

Re: PA Active/Passive and Cisco stacking LACP

PavelK — Tue, 13 Aug 2024 12:43:56 GMT

Hello @K.Mohamed

thank you for reply.

I would configure LACP active on PA as well as Cisco side. I would also recommend to enable the LACP pre-negotiation LACP and LLDP Pre-Negotiation for Active/Passive HA by selecting check box under: LACP > High Availability Options > Enable in HA Passive State.

Kind Regards

Pavel